Ezekiel_Nyangweso/ERP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'Make email and phone unique per business, not platform-wide' (#5) from fix/per-business-identity into main

Browse Source 
Reviewed-on: #5
This commit was merged in pull request #5.
This commit is contained in:
denis_ireri
2026-10-12 08:41:07 +00:00
parent 5e0e44c647 9e3e59a804
commit bae21ee62c
14 changed files with 407 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/identity.test.ts
+152
View File
@@ -0,0 +1,152 @@
import { describe, expect, it } from "vitest";
import bcrypt from "bcryptjs";
import { User } from "@/lib/server/models/User";
import * as users from "@/app/api/users/route";
import * as login from "@/app/api/auth/login/route";
import * as me from "@/app/api/auth/me/route";
import * as platformBusinesses from "@/app/api/platform/businesses/route";
import { ACCESS_COOKIE } from "@/lib/server/auth";
import { json, makeTenant, req, uuid, type Actor, type Tenant } from "./helpers";
const PERSON = { name: "Wanjiru", email: "wanjiru@aquaflow.test", phoneNumber: "0722000111" };
const OPERATOR = "operator@aquaflow.test"; // listed in PLATFORM_ADMIN_EMAILS by tests/setup.ts
async function hire(t: Tenant, as: Actor, person = PERSON) {
return users.POST(
req("POST", "/api/users", { as, body: { ...person, role: "DELIVERY", branchId: t.branchA, password: "password-123" } })
);
}
const signIn = (email: string, password: string, businessId?: string) =>
login.POST(req("POST", "/api/auth/login", { body: { email, password, deviceId: uuid(), businessId } }));
async function setPassword(email: string, businessId: string, password: string) {
await User.updateOne({ email, businessId }, { passwordHash: await bcrypt.hash(password, 4) });
}
function accessCookie(res: Response): string {
const cookie = res.headers.get("set-cookie") ?? "";
return cookie.match(new RegExp(`${ACCESS_COOKIE}=([^;]+)`))![1];
}
describe("email and phone are unique per business", () => {
it("lets one person work for two businesses with the same email and phone", async () => {
const a = await makeTenant("Alpha");
const b = await makeTenant("Beta");
expect((await hire(a, a.owner)).status).toBe(201);
expect((await hire(b, b.owner)).status).toBe(201);
expect(await User.countDocuments({ email: PERSON.email })).toBe(2);
});
it("still refuses a duplicate inside the same business", async () => {
const a = await makeTenant("Alpha");
await hire(a, a.owner);
const sameEmail = await hire(a, a.owner, { ...PERSON, phoneNumber: "0733000222" });
const samePhone = await hire(a, a.owner, { ...PERSON, email: "other@aquaflow.test" });
expect([sameEmail.status, samePhone.status]).toEqual([409, 409]);
});
});
describe("login when an email exists in several businesses", () => {
it("signs straight in when only one account's password matches", async () => {
const a = await makeTenant("Alpha");
const b = await makeTenant("Beta");
await hire(a, a.owner);
await hire(b, b.owner);
await setPassword(PERSON.email, a.businessId, "alpha-secret");
await setPassword(PERSON.email, b.businessId, "beta-secret");
const res = await json(await signIn(PERSON.email, "beta-secret"));
expect(res.status).toBe(200);
expect(res.body.user.businessId).toBe(b.businessId);
});
it("asks which business when the same password opens both, then signs in to the one chosen", async () => {
const a = await makeTenant("Alpha");
const b = await makeTenant("Beta");
await hire(a, a.owner);
await hire(b, b.owner);
await setPassword(PERSON.email, a.businessId, "same-secret");
await setPassword(PERSON.email, b.businessId, "same-secret");
const ask = await json(await signIn(PERSON.email, "same-secret"));
expect(ask.status).toBe(300);
expect(ask.body.chooseBusiness.map((c: any) => c.businessName).sort()).toEqual(["Alpha", "Beta"]);
const chosen = await json(await signIn(PERSON.email, "same-secret", a.businessId));
expect(chosen.status).toBe(200);
expect(chosen.body.user.businessId).toBe(a.businessId);
});
it("reveals nothing about other businesses to a wrong password", async () => {
const a = await makeTenant("Alpha");
const b = await makeTenant("Beta");
await hire(a, a.owner);
await hire(b, b.owner);
const res = await json(await signIn(PERSON.email, "wrong-password"));
expect(res.status).toBe(401);
expect(res.body.chooseBusiness).toBeUndefined();
expect(res.body.error).toBe("Incorrect email or password");
});
it("does not let a wrong guess at one business unlock or reset the other", async () => {
const a = await makeTenant("Alpha");
const b = await makeTenant("Beta");
await hire(a, a.owner);
await hire(b, b.owner);
await setPassword(PERSON.email, a.businessId, "alpha-secret");
await setPassword(PERSON.email, b.businessId, "beta-secret");
for (let i = 0; i < 2; i++) await signIn(PERSON.email, "wrong");
await signIn(PERSON.email, "alpha-secret"); // resets Alpha's counter only
const [alpha, beta] = await Promise.all([
User.findOne({ email: PERSON.email, businessId: a.businessId }),
User.findOne({ email: PERSON.email, businessId: b.businessId }),
]);
expect([alpha!.failedLoginAttempts, beta!.failedLoginAttempts]).toEqual([0, 2]);
});
});
describe("platform operator access", () => {
it("is not granted by an email match alone: another business cannot mint an operator", async () => {
const mallory = await makeTenant("Mallory Water");
await hire(mallory, mallory.owner, { name: "Fake operator", email: OPERATOR, phoneNumber: "0744000333" });
await setPassword(OPERATOR, mallory.businessId, "i-am-the-operator");
const res = await signIn(OPERATOR, "i-am-the-operator");
expect(res.status).toBe(200);
expect((await res.clone().json()).isPlatformAdmin).toBe(false);
const consoleRes = await platformBusinesses.GET(
req("GET", "/api/platform/businesses", { cookies: { [ACCESS_COOKIE]: accessCookie(res) } })
);
expect(consoleRes.status).toBe(403);
});
it("is granted to the flagged account whose email is listed", async () => {
const home = await makeTenant("Operator Co");
await hire(home, home.owner, { name: "Operator", email: OPERATOR, phoneNumber: "0755000444" });
await User.updateOne({ email: OPERATOR, businessId: home.businessId }, { platformAdmin: true });
await setPassword(OPERATOR, home.businessId, "real-operator");
const res = await signIn(OPERATOR, "real-operator");
const cookies = { [ACCESS_COOKIE]: accessCookie(res) };
expect((await platformBusinesses.GET(req("GET", "/x", { cookies }))).status).toBe(200);
expect((await json(await me.GET(req("GET", "/x", { cookies })))).body.user.isPlatformAdmin).toBe(true);
});
it("is revoked by removing the email from PLATFORM_ADMIN_EMAILS, even with the flag", async () => {
const home = await makeTenant("Operator Co");
await hire(home, home.owner, { name: "Operator", email: OPERATOR, phoneNumber: "0755000444" });
await User.updateOne({ email: OPERATOR, businessId: home.businessId }, { platformAdmin: true });
await setPassword(OPERATOR, home.businessId, "real-operator");
const cookies = { [ACCESS_COOKIE]: accessCookie(await signIn(OPERATOR, "real-operator")) };
const listed = process.env.PLATFORM_ADMIN_EMAILS;
process.env.PLATFORM_ADMIN_EMAILS = "";
try {
expect((await platformBusinesses.GET(req("GET", "/x", { cookies }))).status).toBe(403);
} finally {
process.env.PLATFORM_ADMIN_EMAILS = listed;
}
});
});